Networked computing environments have become the mainstay of computing in various ways: information sharing through local networks in office environments, distributed services based on multi-tier systems across an organization, and services hosted on the Internet. Each of these scenarios has varying demands on the networks in terms of functionality, performance, and security. This in turn has resulted in a multitude of hardware and software underlying these networks, a multitude of protocols and standards to interconnect these hardware and software, and a multitude of vendors and solutions supporting all of these. Given these variations, the logistics of creating, allocating, and maintaining a networked environment to meet a specific requirement can be daunting.
The high growth rate of the Internet has resulted in a corresponding growth in networking infrastructure. Logistical reasons such as space management, physical security, power distribution, and communication access have forced the infrastructure to be located in centralized Network Operation Centers (NOCs). These NOCs may be owned by the same organization that uses the infrastructure or by a service provider who hosts the infrastructure for one or more customer organizations. In contrast to this centralization, the modern workforce and its computing needs are increasingly distributed and mobile. As a consequence, the demands on the networking infrastructure vary widely and dynamically. These conflicting requirements have resulted in networking products such as switches, gateways, and firewalls that enable sophisticated solutions to problems like broadcast traffic isolation, remote access control, and secure data sharing. The solutions can be illustrated by techniques such as secure shell (SSH) or virtual private networks (VPNs).
A typical high-level network structure of any present day organization resembles the structure in FIG. 2a. Each L represents a Local Area Network (LAN). LANs are usually divided into sub-networks i.e., subnets, for reasons including administrative convenience, and broadcast traffic isolation. Typically each S represents a (physical) subnet associated with a single switch. (Within the context of FIG. 2a, S can refer to a (physical) subnet or a switch interchangeably). The physical network interconnections such as Ethernet cables are shared media i.e., broadcast media. For instance, all computing devices connected to a single Ethernet cable receive all the information transmitted by any one of the devices. A switch associated with a subnet, isolates traffic within the subnet from traffic outside the subnet. Thus each subnet is a broadcast domain i.e., a computing device within a subnet receives the network traffic of all other devices in the subnet, but the computing device does not receive any network traffic from outside the subnet unless it was specifically addressed to the device. Also, any traffic from one of the devices in the subnet will not be received by a device outside the subnet unless it was specifically addressed to that external device. As shown, switches (and hence subnets) are interconnected using High Bandwidth (HBW) connections, within a LAN. Multiple LANs are interconnected using Low Bandwidth (LBW) connections to form a single private network P. Network traffic to and from a private network is typically controlled by gateways and firewalls. Private networks are interconnected through the Internet.
Networks are manually created to address an organization's computing needs. For example, an organization may host a special event that requires a sudden need for additional computing power. A typical solution would include contacting a NOC to obtain the required computing power. The organization would request specific machines with specific operating systems (“OS”). Once receiving the request, an administrator at the NOC can physically pull the specified machines that already have the specified OS loaded on them from storage or any other location. If the operator cannot find a machine with the specified OS already loaded, the operator would then have to load the specified OS onto the machine. The operator can then physically and manually connect the specified computers to form a network for the organization.
Considering the above-mentioned structure in FIG. 2a, the operator would typically create a new subnet or a LAN with one or more subnets and interconnect the subnet(s) with the existing network(s) for the organization. Again this network creation process is manual and is tied to the physical locations of the switches and other computing devices.
If switches S were special switches referred to as VLAN (Virtual LAN) switches, then broadcast domains need not remain tied to physical subnets. Computing devices from different (physical) subnets can be connected to form a new broadcast domain—which is usually referred to as a virtual LAN i.e., VLAN. In other words VLANs separate the concept of a ‘broadcast domain’ from ‘physical subnets’. VLANs are still restricted to private networks i.e., a broadcast domain can only be formed within a private network. In this new scenario, an organization's request for additional computing power can be met more easily than the previous scenario: computing devices can be added from other (physical) subnets to the existing infrastructure belonging to the organization. This relaxes the location-related constraints involved in incrementally adding computing devices to the network.
Thus, any system that combines the ability to automatically provision networked environments with the ability to program VLAN switches is desirable in its ability to provision networks that are scalable and extensible. Such networks are extensible because incremental addition is easy, automatic and it can be done remotely. They are scalable because the process of scaling will not be tied down by locations of switches and/or locations of computing devices.
Furthermore, private networks restrict external access using security mechanisms such as “firewalls”. At the same time, they may enable selective user-level access to computing devices, and to processes running on these devices using special hardware and software. Since such user-level access extends a private network “virtually”, these are referred to as “Virtual Private Networks (VPN)”. Thus any system which can combine the ability to provision networks and the ability to work across private networks is desirable in provisioning networks that are not scalable and extensible but also secure.